Buffer overflow in Intel Server Platform Services Firmware - CVE-2017-5706

Vulnerability identifier: #VU9388

CSH Severity: Low

CVSS v4: 6.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2017-5706

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The weakness exists due to multiple buffer overflows in kernel. A local attacker can send a specially crafted request, trigger memory corruption, execute arbitrary code an compromise the vulnerable system.

Intel Server Platform Services Firmware
SIMATIC IPC677D
SIMATIC IPC427E
SIMATIC IPC477D
SIMATIC IPC477D PRO
SIMATIC IPC477E
SIMATIC IPC547D
SIMATIC IPC547E
SIMATIC IPC547G
SIMATIC IPC627C
SIMATIC IPC627D
SIMATIC IPC647C
SIMATIC IPC647D
SIMATIC IPC427D
SIMATIC IPC827C
SIMATIC IPC827D
SIMATIC IPC847C
SIMATIC IPC847D
SIMATIC ITP1000
SINUMERIK PCU50.5-C
WIN7
WINXP
SINUMERIK PCU50.5-P
SIMOTION P320-4S
SIMATIC Field-PG M3
SIMATIC Field-PG M4
SIMATIC Field-PG M5
SIMATIC HMI IPC677C
HPE ProLiant DL380 Gen10 Server ROM
HPE Synergy 660 Gen10 Compute Module ROM
HPE ProLiant XL450 Gen10 Server ROM
HPE ProLiant XL230k Gen10 Server ROM.
HPE ProLiant XL190r Gen10 Server ROM
HPE ProLiant XL170r Gen10 Server ROM
HPE ProLiant ML350 Gen10 Server ROM
HPE ProLiant ML110 Gen10 Server ROM
HPE ProLiant ML30 Gen9 Server SPS
HPE ProLiant m710x Server Cartridge ROM
HPE ProLiant DL580 Gen10 Server ROM
HPE ProLiant DL560 Gen10 Server ROM
HPE Synergy 480 Gen10 Compute Module ROM
HPE ProLiant DL360 Gen10 Server ROM
HPE ProLiant DL20 Gen9 Server SPS
HPE ProLiant BL460c Gen10 Server Blade ROM
HPE Apollo 6000 DLC System ROM
HPE Apollo 4510 System ROM
HPE Apollo 2000 System ROM

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr&ref=hvper.com

• Privilege escalation in Intel Server Platform Services Firmware
• Privilege escalation in HPE products
• Multiple vulnerabilities in Siemens SIMATIC, SIMOTION, and SINUMERIK